Vulnerabilities (CVE)

Filtered by CWE-521
Total 192 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-41696 1 Globaldatingsoftware 1 Premiumdatingscript 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php.
CVE-2021-41296 1 Ecoa 5 Ecs Router Controller-ecs, Ecs Router Controller-ecs Firmware, Riskbuster and 2 more 2024-11-21 5.0 MEDIUM 9.8 CRITICAL
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
CVE-2021-40520 1 Airangel 10 Hsmx-app-100, Hsmx-app-1000, Hsmx-app-1000 Firmware and 7 more 2024-11-21 5.0 MEDIUM 9.8 CRITICAL
Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.
CVE-2021-40333 1 Hitachienergy 4 Fox615, Fox615 Firmware, Xcm20 and 1 more 2024-11-21 5.5 MEDIUM 9.0 CRITICAL
Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
CVE-2021-39434 1 Zkteco 1 Zktime 2024-11-21 N/A 7.5 HIGH
A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220.
CVE-2021-38935 1 Ibm 1 Maximo Asset Management 2024-11-21 5.0 MEDIUM 7.5 HIGH
IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892.
CVE-2021-38462 1 Inhandnetworks 2 Ir615, Ir615 Firmware 2024-11-21 7.5 HIGH 9.8 CRITICAL
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf.
CVE-2021-36689 1 Samourai-wallet-android Project 1 Samourai-wallet-android 2024-11-21 N/A 5.5 MEDIUM
An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation.
CVE-2021-35498 1 Tibco 2 Ebx, Product And Service Catalog Powered By Tibco Ebx 2024-11-21 9.3 HIGH 9.8 CRITICAL
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.
CVE-2021-32753 1 Edgexfoundry 1 Edgex Foundry 2024-11-21 5.8 MEDIUM 8.3 HIGH
EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users.
CVE-2021-28914 1 Bab-technologie 2 Eibport, Eibport Firmware 2024-11-21 4.3 MEDIUM 6.5 MEDIUM
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access.
CVE-2021-28912 1 Bab-technologie 2 Eibport, Eibport Firmware 2024-11-21 9.0 HIGH 7.2 HIGH
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
CVE-2021-26797 1 Hametech 2 Hame Sd1 Wi-fi, Hame Sd1 Wi-fi Firmware 2024-11-21 7.5 HIGH 9.8 CRITICAL
An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service.
CVE-2021-25923 1 Open-emr 1 Openemr 2024-11-21 6.8 MEDIUM 8.1 HIGH
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
CVE-2021-25839 1 Minthcm 1 Minthcm 2024-11-21 5.0 MEDIUM 9.8 CRITICAL
A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.
CVE-2021-25309 1 Gigaset 2 Dx600a, Dx600a Firmware 2024-11-21 5.0 MEDIUM 9.8 CRITICAL
The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) allows remote attackers to easily obtain administrative access via brute-force attacks.
CVE-2021-20470 2 Ibm, Netapp 2 Cognos Analytics, Oncommand Insight 2024-11-21 5.0 MEDIUM 7.5 HIGH
IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
CVE-2021-20418 2 Ibm, Linux 2 Security Guardium, Linux Kernel 2024-11-21 5.0 MEDIUM 9.8 CRITICAL
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279.
CVE-2021-1522 1 Cisco 1 Connected Mobile Experiences 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.
CVE-2020-9023 1 Iteris 2 Vantage Velocity, Vantage Velocity Firmware 2024-11-21 7.5 HIGH 9.8 CRITICAL
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password eclipse). Also, bluetooth is the root password.